PT-2023-12264 · Systematic · Systematica Smtp Adapter+1

Publicado 2023-11-30 · Atualizado 2023-12-11 · CVE-2021-35975

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Systematica Radius versions up to 3.9.256.777 Systematica SMTP Adapter component versions up to 2.0.1.101 HTTP Adapter versions up to 1.8.0.15 MSSQL MessageBus Proxy versions up to 1.1.06 Financial Calculator versions up to 1.3.05 FIX Adapter versions up to 2.4.0.25

Description The issue allows remote attackers to read arbitrary files via a full pathname in the file parameter in a URL. This is an absolute path traversal vulnerability.

Recommendations For Systematica Radius versions up to 3.9.256.777, update the Systematica SMTP Adapter component to a version later than 2.0.1.101. For Systematica SMTP Adapter component versions up to 2.0.1.101, avoid using the file parameter in URLs until a patch is available. For HTTP Adapter versions up to 1.8.0.15, restrict access to the adapter to minimize the risk of exploitation. For MSSQL MessageBus Proxy versions up to 1.1.06, consider disabling the proxy until a patch is available. For Financial Calculator versions up to 1.3.05, restrict access to the calculator to minimize the risk of exploitation. For FIX Adapter versions up to 2.4.0.25, consider disabling the adapter until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2021-35975

Produtos afetados

Systematica Radius

Systematica Smtp Adapter

Referências · 5

• 🔥 https://github.com/fbkcs/CVE-2021-35975 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-35975 · Nota de Segurança
• https://t.me/cvenotify/61824 · Publicação no Telegram
• https://t.me/cvenotify/63148 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2021-35975 · Aviso do Fabricante